A simple privacy protecting scheme enabling delegation and ownership transfer for RFID tags

RFID (Radio frequency identification) technology raises many privacy concerns among which the potential tracking of an RFID tag bearer and the eventuality of anillegitimate reading device (reader) collecting information about him. To solve these issues, many RFID privacy protecting protocols assume that readers have continuous connectivity with a centralised on-line database in charge of the identification of a certain amount of tags. Howeversuch centralised models can raise scalability and latency problems. Moreover, they are not suitable in applications where connectivity is intermittent. As RFID tags may often change hands, it is also necessary to guarantee the privacy of a new tag owner. In this paper, we introduce a privacy protecting scheme based on pseudonyms that allows an online database to delegate temporarily and in a secure manner the capability to identify tags to selected readers. A reader which receives delegation for a given tag can identify this tag without referring to the on-line database, thus solving possible intermittent connectivity issues and making tag identification more scalable. Our protocol also manages tags ownership transfer without threatening the new owner's privacy.